You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by ru...@apache.org on 2026/08/28 23:23:08 UTC
(superset) branch chore/security-bump-jsyaml-frontend created (now 02a1c259d09)
This is an automated email from the ASF dual-hosted git repository.
rusackas pushed a change to branch chore/security-bump-jsyaml-frontend
in repository https://gitbox.apache.org/repos/asf/superset.git
at 02a1c259d09 chore(deps): bump js-yaml to patch quadratic-CPU-consumption DoS
This branch includes the following new commits:
new 02a1c259d09 chore(deps): bump js-yaml to patch quadratic-CPU-consumption DoS
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(superset) 01/01: chore(deps): bump js-yaml to patch quadratic-CPU-consumption DoS
Posted by ru...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rusackas pushed a commit to branch chore/security-bump-jsyaml-frontend
in repository https://gitbox.apache.org/repos/asf/superset.git
commit 02a1c259d0929ae47e1551474092e37a1b6269b9
Author: Evan Rusackas <ev...@rusackas.com>
AuthorDate: Fri Aug 28 16:22:43 2026 -0700
chore(deps): bump js-yaml to patch quadratic-CPU-consumption DoS
Patches all five transitive js-yaml instances in
superset-frontend/package-lock.json against GHSA quadratic-CPU-consumption
DoS in !!omap resolution (Dependabot alerts #1514, #1513):
- top-level (via @istanbuljs/load-nyc-config, js-yaml-loader): 3.15.0 -> 3.15.1
- cosmiconfig, lerna, react-diff-viewer-continued, stylelint (each via their
own nested js-yaml): 4.3.0 -> 4.3.1
Added targeted overrides in package.json per consumer rather than a single
blanket override, since the two 3.x consumers and four 4.x consumers are on
incompatible major versions with a different API (safeLoad vs load).
Transitive-only; no application code imports js-yaml directly (webpack.config.js
references the separate js-yaml-loader package by name, itself a build-time-only
webpack loader). No new test needed.
---
superset-frontend/package-lock.json | 30 +++++++++++++++---------------
superset-frontend/package.json | 14 +++++++++++++-
2 files changed, 28 insertions(+), 16 deletions(-)
diff --git a/superset-frontend/package-lock.json b/superset-frontend/package-lock.json
index 55a8394029c..2c9074beb44 100644
--- a/superset-frontend/package-lock.json
+++ b/superset-frontend/package-lock.json
@@ -17804,9 +17804,9 @@
"license": "Python-2.0"
},
"node_modules/cosmiconfig/node_modules/js-yaml": {
- "version": "4.3.0",
- "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
- "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+ "version": "4.3.1",
+ "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+ "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
"dev": true,
"funding": [
{
@@ -26738,9 +26738,9 @@
"license": "MIT"
},
"node_modules/js-yaml": {
- "version": "3.15.0",
- "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.0.tgz",
- "integrity": "sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==",
+ "version": "3.15.1",
+ "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz",
+ "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -27662,9 +27662,9 @@
}
},
"node_modules/lerna/node_modules/js-yaml": {
- "version": "4.3.0",
- "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
- "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+ "version": "4.3.1",
+ "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+ "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
"dev": true,
"funding": [
{
@@ -34750,9 +34750,9 @@
}
},
"node_modules/react-diff-viewer-continued/node_modules/js-yaml": {
- "version": "4.3.0",
- "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
- "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+ "version": "4.3.1",
+ "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+ "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
"funding": [
{
"type": "github",
@@ -38445,9 +38445,9 @@
"license": "ISC"
},
"node_modules/stylelint/node_modules/js-yaml": {
- "version": "4.3.0",
- "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
- "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+ "version": "4.3.1",
+ "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+ "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
"dev": true,
"funding": [
{
diff --git a/superset-frontend/package.json b/superset-frontend/package.json
index a456249428a..28cd877ee9f 100644
--- a/superset-frontend/package.json
+++ b/superset-frontend/package.json
@@ -383,6 +383,9 @@
"@great-expectations/jsonforms-antd-renderers": {
"antd": "$antd"
},
+ "@istanbuljs/load-nyc-config": {
+ "js-yaml": "^3.15.1"
+ },
"@jest/globals": "^30.4.0",
"@jest/types": "^30.4.0",
"@luma.gl/constants": "~9.2.5",
@@ -392,6 +395,9 @@
"@luma.gl/shadertools": "~9.2.5",
"@luma.gl/webgl": "~9.2.5",
"core-js": "^3.38.1",
+ "cosmiconfig": {
+ "js-yaml": "^4.3.1"
+ },
"dompurify": "^3.4.13",
"esbuild": "^0.28.1",
"eslint-plugin-import": {
@@ -408,9 +414,12 @@
"jest-mock": "^30.4.0",
"jest-runtime": "^30.4.0",
"jest-util": "^30.4.0",
+ "js-yaml-loader": {
+ "js-yaml": "^3.15.1"
+ },
"jspdf": "^4.2.0",
"lerna": {
- "js-yaml": "^4.3.0"
+ "js-yaml": "^4.3.1"
},
"minimatch@>=10": {
"brace-expansion": ">=5.0.8"
@@ -418,6 +427,9 @@
"nanoid@>=3 <4": "3.3.18",
"nwsapi": "^2.2.24",
"puppeteer": "^22.4.1",
+ "react-diff-viewer-continued": {
+ "js-yaml": "^4.3.1"
+ },
"tar": "^7.5.16",
"typescript-json-schema": "^0.68.0",
"underscore": "^1.13.7",